CVE-2024-11831

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 5.4EPSS 1%

Published 2025-02-10Updated 2025-04-27

Vulnerability details

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CNAredhat

EPSS score history

Sources

1 links

PoC links are not available for guest users. Login to view them.

CVE Organization

Profile

CVSS

5.4

EPSS

Published

2025-02-10

Updated

2025-04-27

CNA

redhat

Vendors

Red Hat

38 products

CPEs

cpe:/a:redhat:advanced_cluster_security:4.4::el8

cpe:/a:redhat:advanced_cluster_security:4.5::el8

cpe:/a:redhat:ceph_storage:7.1::el9

cpe:/a:redhat:ceph_storage:7.1::el8

cpe:/a:redhat:ceph_storage:8.1::el9

cpe:/a:redhat:ceph_storage:9.0::el10

cpe:/a:redhat:ceph_storage:9.0::el9

cpe:/a:redhat:enterprise_linux:8::appstream

cpe:/a:redhat:enterprise_linux:8::crb

cpe:/a:redhat:enterprise_linux:9::appstream

cpe:/a:redhat:enterprise_linux:9::crb

cpe:/a:redhat:openshift_data_foundation:4.14::el9

cpe:/a:redhat:openshift_data_foundation:4.15::el9

cpe:/a:redhat:openshift_data_foundation:4.16::el9

cpe:/a:redhat:openshift_data_foundation:4.17::el9

cpe:/a:redhat:openshift_data_foundation:4.18::el9

cpe:/a:redhat:ceph_storage:8::el9

cpe:/a:redhat:openshift_pipelines:1.14::el8

cpe:/a:redhat:openshift_pipelines:1.15::el8

cpe:/a:redhat:openshift_pipelines:1.16::el8

cpe:/a:redhat:openshift_pipelines:1.17::el8

cpe:/a:redhat:openshift_pipelines:1.18::el9

cpe:/a:redhat:openshift_pipelines:1.19::el9

cpe:/a:redhat:cryostat:3

cpe:/a:redhat:logging:5

cpe:/a:redhat:migration_toolkit_virtualization:2

cpe:/a:redhat:rhel_dotnet:6.0

cpe:/a:redhat:openshift_lightspeed

cpe:/a:redhat:openshift_pipelines:1

cpe:/a:redhat:serverless:1

cpe:/a:redhat:service_mesh:2

cpe:/a:redhat:red_hat_3scale_amp:2

cpe:/a:redhat:acm:2

cpe:/a:redhat:advanced_cluster_security:4

cpe:/a:redhat:ansible_automation_platform:2

cpe:/a:redhat:apache_camel_hawtio:4

cpe:/a:redhat:service_registry:2

cpe:/a:redhat:optaplanner:::el6

cpe:/a:redhat:ceph_storage:7

cpe:/a:redhat:ceph_storage:8

cpe:/a:redhat:ceph_storage:9

cpe:/a:redhat:jboss_data_grid:8

cpe:/a:redhat:rhdh:1

cpe:/a:redhat:discovery:1

cpe:/o:redhat:enterprise_linux:10

cpe:/o:redhat:enterprise_linux:8

cpe:/o:redhat:enterprise_linux:9

cpe:/a:redhat:jboss_fuse:7

cpe:/a:redhat:integration:1

cpe:/a:redhat:jboss_enterprise_application_platform:7

cpe:/a:redhat:jboss_enterprise_application_platform:8

cpe:/a:redhat:jbosseapxp

cpe:/a:redhat:openshift_ai

cpe:/a:redhat:openshift:3.11

cpe:/a:redhat:openshift:4

cpe:/a:redhat:openshift_devspaces:3

cpe:/a:redhat:openshift_distributed_tracing:3

cpe:/a:redhat:jboss_enterprise_bpms_platform:7

cpe:/a:redhat:quay:3

cpe:/a:redhat:satellite:6

cpe:/a:redhat:red_hat_single_sign_on:7

cpe:/a:redhat:trusted_profile_analyzer:1

cpe:/o:redhat:rhivos:1

cpe:/a:redhat:openshift_lightspeed:1

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated